planetofdefi[.]com

planetofdefi.com is currently active and hosted on IP 216.252.233.14 in the Netherlands, operated by THC Servers Global, LLC. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and uses a Let’s Encrypt R13 certificate. HTTP requests return a 302 redirect and the sole observed page title is “Account Suspended”, which offers no functional content. Google Safe Browsing classifies the site as social engineering, and fifteen of ninety‑one VirusTotal scanners have raised detections, confirming malicious intent. The domain appears on three public blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL, indicating consensus among security products that it is used for crypto‑draining attacks. Nameservers ns1‑ns4.thcservers.com further tie the infrastructure to known threat‑hosting services. No additional payloads, wallet addresses, or phishing pages have been publicly disclosed, leaving the exact theft mechanism uncertain. Defenders should deny outbound connections to the IP, add the domain and its nameservers to deny‑list rules, and monitor for any transaction signatures linked to known crypto‑drainer campaigns. Continuous observation of DNS changes and blocklist updates is advised.